It's possible to hijack the "Select your next badge" call and choose a badge which you've already earned, or one which doesn't even display (e.g. Marshal if you're a ♦ moderator).
Steps to reproduce:
- Visit your profile page
- Open the browser console
- Find your
fkey(it's in one of the
fkeyand the badge name into the following jQuery snippet, and execute it in the console:
$.post("/users/activity/next-badge-popup/save", "fkey=[YOUR FKEY HERE]&badgeDatabaseName=[BADGE NAME]&isTagBadge=false")
Note that the badge does need to exist on the site; e.g. you can't use this to track the Informed badge on a child meta.
I'd expect some server side check on this as well, though it's obviously not as open to abuse as this issue.